Port 464: kpasswd
Port 464 is used to change a Kerberos password, separate from the authentication traffic on port 88. A Kerberos client contacts this port on the Key Distribution Center whenever a user updates their password.
| Port number | 464 |
|---|---|
| Service | Kerberos password change |
| Protocol | TCP/UDP |
| Category | Authentication |
| Default encryption | No |
How do I check whether port 464 is open?
Port 464 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 464 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 464 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':464 ' | Lists the process bound to port 464 on Linux. On macOS use lsof -nP -iTCP:464 -sTCP:LISTEN, on Windows netstat -ano | findstr :464 |
| Is it open on a remote host? | sudo nmap -sU -p 464 example.com | UDP has no handshake, so there is nothing to complete. nmap infers the state from whether an ICMP port-unreachable comes back, needs root, and is slow and easy to misread. A silent port may be open, filtered, or simply not replying to a probe it does not recognise. |
| What is listening locally? | ss -ulnp | grep ':464 ' | Shows the UDP socket bound to port 464. This is the reliable way to answer the question, because you are asking the host itself rather than guessing from outside. |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
What is port 464 used for?
Port 464 is used to change a Kerberos password, separate from the authentication traffic on port 88. A Kerberos client contacts this port on the Key Distribution Center whenever a user updates their password.
Is port 464 TCP or UDP?
Port 464 (kpasswd) uses TCP/UDP.
Is port 464 secure?
Port 464 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 464 on my firewall?
Only if you specifically need kpasswd. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.